Contributor
•
23 Messages
transparent dns proxying started after a modem swap ...
Today my gateway was replaced with a
Model:CGA4131COM
Vendor:Technicolor
Hardware Revision:2.1
running the following firmware...
eMTA & DOCSIS Software Version:CM DOCSIS Application - Prod_17.20_d31 & MTA Application - Prod_17.2
Software Image Name:CGA4131COM_3.1p24s1_PROD_sey
Advanced Services:CGA4131COM
Packet Cable:2.0
I have static ips and run a dns server slave and mail server, the dns zones stopped downloading right after the swap... looking at the errors, the SOA of my zones were incorrect...
When trying the following tests, I was surprised to see that any random ip could be used as a dns server and was responding to dns queries implying that some kind of transparent dns proxy was occuring...
root@infra:/etc/bind# nslookup www.comcast.com 1.2.3.4 Server: 1.2.3.4 Address: 1.2.3.4#53 Non-authoritative answer: www.comcast.com canonical name = www.comcast.com.edgekey.net. www.comcast.com.edgekey.net canonical name = e523.dscb.akamaiedge.net. Name: e523.dscb.akamaiedge.net Address: 23.45.1.143 root@infra:/etc/bind# nslookup www.comcast.com 4.5.6.7 Server: 4.5.6.7 Address: 4.5.6.7#53 Non-authoritative answer: www.comcast.com canonical name = www.comcast.com.edgekey.net. www.comcast.com.edgekey.net canonical name = e523.dscb.akamaiedge.net. Name: e523.dscb.akamaiedge.net Address: 23.45.1.143 root@infra:/etc/bind# nslookup www.comcast.com 9.8.7.6 Server: 9.8.7.6 Address: 9.8.7.6#53 Non-authoritative answer: www.comcast.com canonical name = www.comcast.com.edgekey.net. www.comcast.com.edgekey.net canonical name = e523.dscb.akamaiedge.net. Name: e523.dscb.akamaiedge.net Address: 23.45.1.143As it was not happening before, I'm assuming that it is a weird behavior from the gateway... it is configured in pass thru, firewall is disabled, wan dhcp is disabled, all rules are off... Is that a bug ? Am I missing some obvious button to disable that dreadful transparent proxying ?
CC_Gina
Gold Problem solver
•
421 Messages
5 years ago
Hi there GaelMartinez! Congratulations on the new gateway and thank you for taking the time to post your question about disabling the proxy! Have you already disabled the proxy settings on each connected device?
0
0
GaelMartinez
Contributor
•
23 Messages
5 years ago
0
0
Comcast_Ken
Official Employee
•
128 Messages
5 years ago
0
0
GaelMartinez
Contributor
•
23 Messages
5 years ago
I will test in a bit, on the phone with another support tech, I did confirm that outbound port 53/tcp traffic does not reach its destination when portscanning between one of my servers directly plugged into the gateway and my remote server...
0
0
Comcast_Ken
Official Employee
•
128 Messages
5 years ago
OK cool. I'll check back in with you later then!
0
0
GaelMartinez
Contributor
•
23 Messages
5 years ago
Hello Ken
So after engineering looked at it, i was told it is not a comcast issue, "it is outside your boundaries for support"... it is an issue with my devices on the internet not recognizing my new modem....
Even if:
- the existing configuration worked for nearly 8 years until the modem was replaced...
- I can connect to various other servers on the internet on ports 48, 49, 50, 51,52,54,55,56 tcp but NOT 53 tcp/udp
- Looks like that new thingie Security Edge is definitively monitoring my dns traffic and cannot be turned off, the button is blocked ! I have my own security solution in place, I do not need comcast to restrict me like that...
- The fact that ANY ip on the internet does now appear as a valid functional DNS server when they should not !
- I'm impacted and cannot conduct my business as I did before 12/24 and had to rehost mail and dns servers to another location
- I cannot replace that gateway with my own without losing the static ips I have to avoid whatever firmware is impacting me
Thank you Comcast Business !... it is awesome to do business with you... I feel valued... not...
0
0
Comcast_Gabriel
Official Employee
•
298 Messages
5 years ago
Hi! Thank you so much for providing this information and for your patience. I am sorry to learn that we have made you feel this way. We truly value you and are honored by your business. One option is seeing if we can find you a better bundle that does not include the Security Edge service. How does this sound?
0
0
GaelMartinez
Contributor
•
23 Messages
5 years ago
Hello Gabe,
I would love that a lot.
0
0
Comcast_Gabriel
Official Employee
•
298 Messages
5 years ago
Fantastic! You are awesome for bearing with me through this. What I recommend from here is to give our Loyalty team a call at (800) 391-3000. Our Loyalty department are a team of specialists who are dedicated to resolving package concerns such as this. How does this sound? What I would like to do from here is follow up with you on Monday to make sure you were able to receive a solution from our Loyalty team since I will be offline for the weekend.
0
0
GaelMartinez
Contributor
•
23 Messages
5 years ago
Will call tomorrow, hope it solves my issue with the port 53 blockage...
0
0
Comcast_Gabriel
Official Employee
•
298 Messages
5 years ago
Sounds good. I will be offline until Monday, 12/30/19 so I will make sure to follow up with you then to ensure that you receive a solution. In the meantime, please feel free to reach out for any additional questions or concerns. We team is here for you 24/7!
0
0
GaelMartinez
Contributor
•
23 Messages
5 years ago
Hello Gabe
Called the loyalty team and was told they could not remove it as it was part of the current package i was moved into when I upgraded my bandwitdh... the issue is still present and now the security edge website throws an error at me when trying to connect to it ..
0
0
CC_Anisa
Problem solver
•
348 Messages
5 years ago
Hi there, I am so sorry to see that we have not yet reached a resolution with your concerns. I am so sorry for the delayed response and we do want to make sure that we can reach a resolution as quickly as possible and we can submit a request to look into this further for you. Can you please confirm the best contact number to reach you?
0
0
CC_Michelle
Official Employee
•
526 Messages
5 years ago
I would love to look further into your DNS concerns. Can you please reach out through private message with your first and last name, full service address and account number or phone number and we would love to assist at any time. You can always reach us here through the business forums or you can reach out at any time through 1-800-391-3000 if this is a more convenient option for you.
0
0
brmoorelaw
New Contributor
•
3 Messages
5 years ago
I seem to have the a similar problem and find myself increasingly annoyed as I discover all the problems with this router (CGA4131COM). What really bothers me is that I manually set my DNS, saved the settings..and they appeared to save as expected, yet, when I test those settings I find the DNS remain unchanged from default. I just got the router and this weekend was my first chance to learn about what I received. I started looking closer when I noticed problems with connection drops, which led to discovery of ipv6 issues... and on from there until I thought I was just going crazy.
Unfortunately I have court all day Monday but I will definitely need to speak to someone about rectifying the situation as soon as possible thereafter.
I would like to know how many of these routers were distributed to customers after significant issues were identified months ago? I hope I am just missing the solution thread and someone will point me to it real soon.
0
0